Qilin ransomware group claims attack on US law firm Iliff, Meredith, Wildberger & Brennan
The criminal group listed the Pennsylvania professional-services firm on its dark-web site on 13 October 2026. No public confirmation exists.
Key points
- Qilin listed US law firm Iliff, Meredith, Wildberger & Brennan, P.C. On its dark-web pressure site on 13 October 2026, according to monitoring service Ransomware.live.
- The firm has not publicly confirmed any incident, and the claim could not be independently verified at publication time.
- Qilin's posting contained no detail about what, if anything, was taken.
- Listings on criminal leak sites are sometimes exaggerated, sometimes outright false.
Iliff, Meredith, Wildberger & Brennan, P.C. Appeared on Qilin's dark-web leak site on 13 October 2026. Ransomware groups run these sites, sometimes called name-and-shame pages, to pressure companies into paying a ransom by threatening to publish stolen files. The listing is a criminal's claim, not a confirmed fact.
Qilin's posting text was blank. The firm, which operates as ilimer.com, has made no public statement about any incident.
Who is Qilin, and how active are they?
Qilin is among the more active ransomware groups tracked right now. We've covered the group ten times since first reporting on it on 24 June 2026, with nine of those stories published in the past 90 days alone, including an unverified claim against Texas-based Genesis Credit Management on 4 October.
Ransomware, put plainly, is malicious software that criminals use to lock a company's files and demand payment to restore access. The leak site is a separate pressure tactic: publish the victim's name to embarrass them into paying even if their backups are intact. Listings can be accurate, exaggerated or false. Criminal groups have clear incentives to overstate their reach.
This is also the fourth law-firm listing we've reported in 90 days. Rhysida claimed Reed & Giordano PA on 12 October, and Silentransomgroup listed Baker McKenzie on 9 October. Law firms hold privileged client records, which makes them attractive targets.
Should clients or staff of the firm be worried?
The claim is unverified, but waiting for official confirmation before taking basic precautions isn't the right call.
Anyone who has dealt with the firm, whether as a client or an employee, should watch for phishing emails: fake messages designed to trick people into handing over passwords or clicking harmful links. Criminals sometimes use news of a claimed breach to craft convincing fakes that appear to come from the affected organisation.
Don't reuse passwords across accounts, and consider changing any password tied to correspondence with the firm. Be sceptical of unexpected calls or emails offering "breach compensation" or asking you to confirm personal details. These scams surface routinely after a company is named publicly. Any official notification from the firm should be verified through a channel you can confirm independently, such as a phone number from its official website.
The real test for Qilin's claim will be whether the firm issues a breach notice under US state or federal requirements. Until then, it's an allegation from a criminal group with a financial motive to exaggerate.
